feat: promote npm edge tag to latest when prerelease is promoted

[AaronFeledy]

Problem

When a release is published as a prerelease, it gets tagged as edge on npm. Later, when the release is promoted to a full release in GitHub, the npm latest tag doesn't update because the workflow only triggered on published.

Solution

• Added released to the release workflow trigger types
• New lightweight promote job that only runs npm dist-tag add latest — no install, no lint, no tests, no re-publish
• Only fires on the released event (when a prerelease is promoted to full release)
• Existing deploy job is now explicitly gated to published events only (no behavior change)
• Uses TAG_NAME env var instead of direct interpolation to prevent script injection

Flow

1. Publish as prerelease → full pipeline runs, publishes with edge tag (unchanged)
2. Promote release → uncheck prerelease → promote job runs, points latest to that version (~15s)

The dist-tag add command is idempotent, so if both published and released fire on a fresh non-prerelease publish, the redundant promote is harmless.

---

Note

Low Risk
Workflow-only change that adjusts npm dist-tags and job triggering; low code risk, but could affect release automation if misconfigured.

Overview
Updates the release.yml workflow to also run on GitHub release events of type released, and adds a new promote job that runs only for released actions to move npm latest to the promoted version via npm dist-tag add.

Gates the existing deploy job to run only on published actions, avoiding re-running the publish pipeline during promotions.

^{Written by Cursor Bugbot for commit abd81f5. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

Promote job fails on fresh non-prerelease publishes

Medium Severity

When a fresh (non-prerelease) release is published, GitHub fires both published and released events, triggering two separate workflow runs. The promote job (~30s) will complete long before the deploy job (~5-10min) finishes publishing to npm. Since the version doesn't exist on the registry yet, npm dist-tag add will fail, causing a red X on every non-prerelease publish. The PR description claims "the redundant promote is harmless," but the race condition means it errors rather than succeeding idempotently.

Additional Locations (1)

• .github/workflows/release.yml#L5-L7

 

[netlify]

✅ Deploy Preview for lando-symfony ready!

Name	Link
🔨 Latest commit	abd81f5
🔍 Latest deploy log	https://app.netlify.com/projects/lando-symfony/deploys/6997dca6fe576d0008bc3b0d
😎 Deploy Preview	https://deploy-preview-83--lando-symfony.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 91 (🔴 down 1 from production) Accessibility: 96 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify project configuration.